- AndroxGh0st uses the Mozi botnet to target vulnerabilities in IoT and cloud.
- The combination strengthens both malware strains.
The operators of the AndroxGh0st malware are stepping up their game, expanding attacks to exploit a broader range of security holes in online applications and using the Mozi botnet for extra distribution capability.
According to a recent CloudSEK report, AndroxGh0st uses remote code execution and credential-stealing techniques to stay hidden and embedded in systems. By exploiting unpatched vulnerabilities, it’s able to slip into a target’s infrastructure without detection.
What exactly are AndroxGh0st and Mozi?
AndroxGh0st is a Python-based malware that sets up botnets to help hackers find and exploit targets in networks. It hunts for .env files, which often contain credentials for major services like AWS, Microsoft Office 365, SendGrid, and Twilio, especially Laravel-based applications (Laravel is a PHP framework). AndroxGh0st can also scan for exposed credentials, exploit APIs, and deploy web shells through Simple Mail Transfer Protocol (SMTP) to extend its reach in systems.
One of its go-to moves is scanning websites for specific vulnerabilities. AndroxGh0st is known to exploit CVE-2017-9841, a well-known flaw in PHPUnit, which lets remote PHP code run on sites. Sites with exposed ‘/vendor’ folders are especially vulnerable, as attackers can send malicious HTTP POST requests to ‘/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php’ allowing them to execute code on a server.
Mozi is older—it surfaced in 2019—and has been very effective in compromising fleets of IoT devices. Mozi has infected over 1.5 million devices globally, targeting IoT endpoints and DSL routers. Its primary objectives are to build large botnets used in DDoS attacks, data theft, and remote command execution. Most of Mozi’s infections have been concentrated in China, but researchers have also seen the malware active in Germany. Surprisingly, the Mozi botnet was shut down in late September 2023, with some suggesting that Chinese government enforcement may have played a part in its closure.
AndroxGh0st’s new attack strategy
Earlier this year, US cybersecurity agencies revealed that AndroxGh0st was actively creating botnets aimed at finding and exploiting weaknesses in networks. CloudSEK’s latest analysis shows that AndroxGh0st’s operators are targeting a wide range of vulnerabilities, including:
- CVE-2014-2120 – Cisco ASA WebVPN cross-site scripting (XSS)
- CVE-2018-10561 & CVE-2018-10562 – Dasan GPON authentication and command injection
- CVE-2021-26086 – Atlassian Jira path traversal
- CVE-2021-41277 – Metabase GeoJSON file inclusion
- CVE-2022-1040 – Sophos Firewall authentication bypass
- CVE-2022-21587 – Oracle EBS file upload
- CVE-2023-1389 – TP-Link Archer firmware injection
- CVE-2024-4577 – PHP CGI argument injection
- CVE-2024-36401 – GeoServer remote code execution
CloudSEK also found that AndroxGh0st is taking a more “hands-on” approach to breaking into WordPress dashboards. It cycles through common admin usernames and uses predictable password patterns to gain access, giving attackers control over essential site functions.
A powerful combo with Mozi
AndroxGh0st is now deploying Mozi as well, targeting command execution flaws in devices from the likes of Netgear and Dasan to drop a payload, ‘Mozi.m’ sourced from external servers, indicating that the two malware instigators may be working together.
By adopting Mozi’s IoT infection and spreading tactics, AndroxGh0st can reach more devices and gain new entry points into networks. Mozi’s capabilities allow AndroxGh0st to expand its reach and conduct attacks that would normally require separate routines.
The integration between AndroxGh0st and Mozi is of concern to cybersecurity experts. Shared infrastructure and overlapping techniques hint that the same cybercriminal group could control both botnets. This collaboration doesn’t just make their operations smoother—it amplifies their impact, making more systems vulnerable.
Looking to revamp your digital transformation strategy? Learn more about Digital Transformation Week taking place in Amsterdam, California, and London.
